[PATCH v2 0/2] Follow changes to the host nameserver for DNS forwarding

[Aditya Merchant <adityamerchant08@gmail.com>]

Patch 1/2 is v2 of "conf: Follow changes to the host nameserver used for
DNS forwarding", reworked after Stefano's review. Patch 2/2 terminates
the inotify buffer in pasta_netns_quit_inotify_handler() as well, as
also pointed out there.

v2:
- Only follow a file called resolv.conf, or a link to one, and never
  open anything else through the copy of its directory: the name is now
  fixed, not kept in struct ctx (Stefano)
- Don't follow changes if we can't make the copy read-only, which needs
  Linux 5.12, instead of going on with a writable copy (Stefano)
- Never copy the root directory, if resolv.conf turns out to be there
- Terminate the inotify buffer, and stop at the first relevant event or
  at an overflow (Stefano)
- SELinux: allow watching /etc, and the directories NetworkManager and
  systemd-resolved use under /run (Stefano)
- AppArmor: a single rule for the locations under /run, as we don't
  follow stub-resolv.conf anymore
- Add test/pasta_options/dns_host_follow (Stefano)
- Rebase on current master

Tested on Kali (arm64, Linux 7.1), with the AppArmor profile enforcing.
With pasta alone, these changes are followed: resolv.conf replaced by
rename, rewritten in place, empty at start and filled in later, and as a
link into /run/resolvconf or /run/systemd/resolve. With --dns-host, or
with a link to stub-resolv.conf, the address stays fixed, as expected.
With rootless Podman 5.8.6 and a bridge network, container DNS keeps
working after the host switches nameserver (it fails with the current
Debian package). The new test passes, and fails without patch 1/2. If
mount_setattr() fails (I faked that), pasta doesn't follow changes and
says so in a debug message. pasta still exits when the namespace file
it watches is removed. 'make cppcheck' and 'make clang-tidy' pass.

The SELinux module builds against Fedora 45's policy, but I couldn't try
it with SELinux enforcing.

Aditya Merchant (2):
  conf: Follow changes to the host nameserver used for DNS forwarding
  pasta: Terminate inotify buffer, skip nameless events in netns watch

 conf.c                              | 259 ++++++++++++++++++++++++++--
 conf.h                              |   2 +
 contrib/apparmor/abstractions/pasta |   4 +
 contrib/selinux/pasta.te            |   4 +
 epoll_type.h                        |   2 +
 isolation.c                         |   6 +-
 isolation.h                         |   2 +-
 linux_dep.h                         |  30 ++++
 passt.1                             |   5 +-
 passt.c                             |   5 +
 passt.h                             |   7 +
 pasta.c                             |   5 +-
 test/pasta_options/dns_host_follow  |  28 +++
 test/run                            |   1 +
 14 files changed, 346 insertions(+), 14 deletions(-)
 create mode 100644 test/pasta_options/dns_host_follow

-- 
2.50.1 (Apple Git-155)